Defense against the Black Arts : How Hackers Do What They Do and How to Protect against It

408 Pages·2011·22.31 MB·English

by  Jesse Varsalone

Security & Auditing M V
a
c
r
F
s
a
As technology has developed, computer hackers have become increasingly a
d
l
sophisticated, mastering the ability to hack into even the most impenetrable systems. d o
e n
The best way to secure a system is to understand the tools hackers use and know n e
how to circumvent them. Defense against the Black Arts: How Hackers Do What
They Do and How to Protect against It provides hands-on instruction to a host of
D
techniques used to hack into a variety of systems. Exposing hacker methodology
with concrete examples, Defense against the Black Arts shows you how to outwit e
computer predators at their own game. Among the many things you’ll learn: f
e
• How to get into a Windows operating system without having the username
n
or password
s
• The vulnerabilities associated with passwords and how to keep them out of
e
the hands of hackers

• How hackers use the techniques of computer forensic examiners to wreak a
havoc on individuals and companies
g
• Hiding one’s IP address to avoid detection
a
• To manipulate data to and from a web page or application for nefarious reasons
i
n
• How to find virtually anything on the Internet
s
• How hackers research the targets they plan to attack
t
• How network defenders collect traffic across the wire to identify intrusions

• To use Metasploit to attack weaknesses in systems that are unpatched or t
h
have poorly implemented security measures
e
The book profiles a variety of attack tools and examines how Facebook and other
B
sites can be used to conduct social networking attacks. It also covers techniques
utilized by hackers to attack modern operating systems, such as Windows 7,
l
a
Windows Vista, and Mac OS X. The author explores a number of techniques that
hackers can use to exploit physical access, network access, and wireless vectors. c
Using screenshots to clarify procedures, this practical manual uses step-by-step k
examples and relevant analogies to facilitate understanding, giving you an insider’s

view of the secrets of hackers. A
r
t
K11123
s
ISBN: 978-1-4398-2119-0
90000
www.crcpress.com
9 781439 821190
www.auerbach-publications.com
K11123 cvr mech.indd 1 7/21/11 1:19 PM
Defense against
the Black Arts
How Hackers Do What They Do
and How to Protect against It
OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
Building an Enterprise-Wide Business Intelligent Video Surveillance:
Continuity Program Systems and Technology
Kelley Okolita Edited by Yunqian Ma and Gang Qian
ISBN 978-1-4200-8864-9 ISBN 978-1-4398-1328-7
Critical Infrastructure: Homeland Security Managing an Information Security and
and Emergency Preparedness, Privacy Awareness and Training Program,
Second Edition Second Edition
Robert Radvanovsky and Allan McDougall Rebecca Herold
ISBN 978-1-4200-9527-2 ISBN 978-1-4398-1545-8
Data Protection: Governance, Mobile Device Security: A Comprehensive
Risk Management, and Compliance Guide to Securing Your Information in
David G. Hill a Moving World
ISBN 978-1-4398-0692-0 Stephen Fried
ISBN 978-1-4398-2016-2
Encyclopedia of Information Assurance
Edited by Rebecca Herold and Marcus K. Rogers Secure and Resilient Software Development
ISBN 978-1-4200-6620-3 Mark S. Merkow and Lakshmikanth Raghavan
ISBN 978-1-4398-2696-6
The Executive MBA in Information Security
John J. Trinckes, Jr. Security for Service Oriented
ISBN 978-1-4398-1007-1 Architectures
Bhavani Thuraisingham
FISMA Principles and Best Practices: ISBN 978-1-4200-7331-7
Beyond Compliance
Patrick D. Howard Security of Mobile Communications
ISBN 978-1-4200-7829-9 Noureddine Boudriga
ISBN 978-0-8493-7941-3
HOWTO Secure and Audit Oracle 10g
and 11g Security of Self-Organizing Networks:
Ron Ben-Natan MANET, WSN, WMN, VANET
ISBN 978-1-4200-8412-2 Edited by Al-Sakib Khan Pathan
ISBN 978-1-4398-1919-7
Information Security Management:
Concepts and Practice Security Patch Management
Bel G. Raggad Felicia M. Nicastro
ISBN 978-1-4200-7854-1 ISBN 978-1-4398-2499-3
Information Security Policies and Security Risk Assessment Handbook:
Procedures: A Practitioner’s Reference, A Complete Guide for Performing Security
Second Edition Risk Assessments, Second Edition
Thomas R. Peltier Douglas Landoll
ISBN 978-0-8493-1958-7 ISBN 978-1-4398-2148-0
Information Security Risk Analysis, Security Strategy: From Requirements
Third Edition to Reality
Thomas R. Peltier Bill Stackpole and Eric Oksendahl
ISBN 978-1-4398-3956-0 ISBN 978-1-4398-2733-8
Information Technology Control and Audit, Vulnerability Management
Third Edition Park Foreman
Sandra Senft and Frederick Gallegos ISBN 978-1-4398-0150-5
ISBN 978-1-4200-6550-3
AUERBACH PUBLICATIONS
www.auerbach-publications.com
To Order Call: 1-800-272-7737 • Fax: [phone]
E-mail: [email protected]
Defense against
the Black Arts
How Hackers Do What They Do
and How to Protect against It
Jesse Varsalone
Matthew McFadden
with
Sean Morrissey
Michael Schearer (“theprez98”)
James “Kelly” Brown
Ben “TheX1le” Smith
Foreword by Joe McCray
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2012 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20110513
International Standard Book Number-13: 978-1-4398-2122-0 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to
publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials
or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material repro-
duced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any
form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming,
and recording, or in any information storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://www.copy-
right.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400.
CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been
granted a photocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identifica-
tion and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Foreword............................................................................................................................xiii
Authors.................................................................................................................................xv
1 Hacking.Windows.OS...................................................................................................1
Introduction.......................................................................................................................1
Physical.Access....................................................................................................................2
Live.CDs...................................................................................................................3
Just.Burned.My.First.ISO.................................................................................4
Before.You.Start.........................................................................................................6
Utility.Manager..................................................................................................................8
Sticky.Keys........................................................................................................................15
How.to.Log.In.without.Knowing.the.Password.................................................................21
Using.Kon-Boot.to.Get.into.Windows.without.a.Password.....................................24
Bart’s.PE.and.WindowsGate....................................................................................26
Old.School........................................................................................................................29
2000.Server.Family.Domain.Controllers.................................................................30
Defending.against.Physical.Attacks.on.Windows.Machines..............................................31
Partitioning.Your.Drive.for.BitLocker.....................................................................32
Windows.7.....................................................................................................32
Windows.Vista...............................................................................................32
Trusted.Platform.Modules........................................................................................33
Using.BitLocker.with.a.TPM.........................................................................34
Using.BitLocker.without.a.TPM....................................................................34
Windows.7......................................................................................................35
Vista.and.2008...............................................................................................38
BitLocker.Hacks......................................................................................................39
TrueCrypt...............................................................................................................39
Evil.Maid.................................................................................................................43
Summary...........................................................................................................................45
2 Obtaining.Windows.Passwords..................................................................................47
Introduction......................................................................................................................47
Ophcrack..........................................................................................................................48
v
vi  ◾  Contents
Password.Hashes...............................................................................................................50
Nediam.com.mx.......................................................................................................51
John.the.Ripper........................................................................................................51
Rainbow.Tables.......................................................................................................54
Cain.&.Abel......................................................................................................................57
Helix.................................................................................................................................71
Switchblade.......................................................................................................................77
Countermeasures.....................................................................................................86
Summary..........................................................................................................................87
3 Imaging.and.Extraction..............................................................................................89
Introduction.....................................................................................................................89
Computer.Forensic.Tools..................................................................................................90
Imaging.with.FTK.Imager......................................................................................90
Live.View.................................................................................................................93
Deleted.Files.and.Slack.Space..................................................................................99
Forensic.Tool.Kit...................................................................................................100
Imaging.with.Linux.dd...........................................................................................103
Understanding.How.Linux.Recognizes.Devices............................................103
Creating.a.Forensic.Image.............................................................................107
Imaging.over.a.Network................................................................................111
Examining.an.Image..............................................................................................114
Autopsy..................................................................................................................115
Conclusion.......................................................................................................................117
4 Bypassing.Web.Filters...............................................................................................119
Introduction....................................................................................................................119
Information.You.Provide................................................................................................120
Changing.Information....................................................................................................120
Summary.........................................................................................................................131
5 Manipulating.the.Web..............................................................................................133
Introduction....................................................................................................................133
Change.the.Price.with.Tamper.Data................................................................................133
Paros.Proxy......................................................................................................................138
Firebug............................................................................................................................143
SQL.Injection..................................................................................................................144
Cross-Site.Scripting.........................................................................................................146
Countermeasures.............................................................................................................148
Parameterized.Statements.......................................................................................149
Validating.Inputs....................................................................................................149
Escaping.Characters...............................................................................................149
Filtering.Characters.and.Statements.......................................................................149
Encryption..............................................................................................................149
Account.Privileges..................................................................................................149
Errors......................................................................................................................150
Further.Resources.and.References....................................................................................150
Contents  ◾  vii
6 Finding.It.All.on.the.Net...........................................................................................151
Introduction....................................................................................................................151
Before.You.Start...............................................................................................................152
Researching.with.Caution................................................................................................155
RapidShare......................................................................................................................157
Advanced.Google.............................................................................................................162
YouTube...........................................................................................................................163
News.Servers....................................................................................................................166
BitTorrent........................................................................................................................167
Other.Options.................................................................................................................167
ShodanHQ.com...............................................................................................................171
7 Research.Time...........................................................................................................179
Overview.........................................................................................................................179
Research,.Time,.and.Planning.........................................................................................180
All.Vectors.Possible..........................................................................................................180
Internal.or.External.Intelligence......................................................................................181
Direct.Contact.versus.Indirect.Contact...........................................................................181
Learning.the.Topology.....................................................................................................182
Learning.the.Structure.....................................................................................................183
Techniques.and.Tools......................................................................................................184
Whois..............................................................................................................................184
Reserved.Addresses..........................................................................................................184
How.to.Defend................................................................................................................186
Domain.Dossier:.Central.Ops.........................................................................................187
Defense.against.Cyber.Squatters......................................................................................189
DNS.Records...................................................................................................................189
Traceroute........................................................................................................................190
Commands.to.Perform.a.Command.Line.Traceroute.............................................192
Traceroute:.Central.Ops.........................................................................................192
Traceroute:.Interpretation.of.DNS...................................................................................193
Disable.Unused.Services..................................................................................................195
Domain.Check:.Central.Ops...........................................................................................195
Email.Dossier:.Central.Ops.............................................................................................195
Site.Report:.Netcraft.com................................................................................................196
Wayback.Machine:.Archive.org.......................................................................................198
How.to.Defend.against.This...................................................................................199
Whois.History:.DomainTools.org....................................................................................199
Zone-h.org......................................................................................................................200
Indirect.Web.Browsing.and.Crawling.............................................................................200
Indirect.Research:.Google.com........................................................................................201
Google.Search.Commands.....................................................................................201
How.to.Defend.against.This..................................................................................202
Indirect.Recon:.Cache,.Google.com...............................................................................202
Indirect.Research:.Google.Hacking.Database.................................................................203
Indirect.Research:.lmgtfy.com........................................................................................203
Indirect.Research:.Duckduckgo.com..............................................................................204
Summary........................................................................................................................204
viii  ◾  Contents
8 Capturing.Network.Traffic........................................................................................205
Overview........................................................................................................................205
Network.Placement........................................................................................................206
Collision.Domains..........................................................................................................206
Intrusion.Detection.at.the.Packet.Level..........................................................................207
Monitoring.Limitations..................................................................................................207
Network.Response.Methodology....................................................................................208
Monitoring/Capturing....................................................................................................208
Viewing.Text.Data..........................................................................................................209
Searching.Text.and.Binary..............................................................................................209
Filtering...........................................................................................................................210
Windows.Executable.and.Signatures................................................................................211
Common.File.Signatures.of.Malware...............................................................................211
Snort................................................................................................................................212
Snort.Rules......................................................................................................................212
Making.a.Snort.Rule.......................................................................................................213
Sample.Content.Fields.....................................................................................................213
Analysis...........................................................................................................................213
Capture.Information........................................................................................................213
Capinfos..........................................................................................................................214
Setting.Up.Wireshark......................................................................................................214
Coloring.Rules.................................................................................................................214
Filtering.Data.in.Wireshark.............................................................................................215
Wireshark.Important.Filters............................................................................................215
Wireshark.Operators........................................................................................................216
Wireshark.Filters..............................................................................................................216
Packet.Options................................................................................................................217
Following.the.Stream.......................................................................................................218
Wireshark.Statistics.........................................................................................................218
Network.Extraction.........................................................................................................219
Summary.........................................................................................................................221
9 Research.Time:.Finding.the.Vulnerabilities..............................................................223
Overview........................................................................................................................223
Methodology..................................................................................................................223
Stealth.............................................................................................................................224
Offensive.Security’s.Exploit.Database.............................................................................225
CVEs..............................................................................................................................226
Security.Bulletins..................................................................................................226
Zero.Day.Exploits...........................................................................................................227
Security.Focus................................................................................................................227
Shellcode.........................................................................................................................229
Running.Shellcode................................................................................................229
BackTrack.......................................................................................................................230
BackTrack.Tools....................................................................................................230
BackTrack.Scanning........................................................................................................231
Windows.Emulation.in.BackTrack..................................................................................231
Contents  ◾  ix
Wine................................................................................................................................231
A.Table.for.Wine.Commands.........................................................................................232
Information.Gathering.and.Vulnerability.Assessment.Using.BackTrack.........................232
Maltego..........................................................................................................................232
Nmap..............................................................................................................................233
Zenmap..................................................................................................................233
Nmap.Scanning.for.Subnet.Ranges.(Identifying.Hosts).........................................235
Nmap.Scanning.for.Subnet.Ranges.(Identifying.Services).....................................236
Nmap.Scanning.for.Subnet.Ranges.(Identifying.Versions)....................................237
Nmap.Scanning.Firewall/IDS.Evasion..................................................................238
Nmap.Scanning.Decoys........................................................................................239
Nmap.Randomization.and.Speed..........................................................................240
PortQry...........................................................................................................................241
Autoscan..........................................................................................................................241
Nessus..............................................................................................................................241
Upgrade.the.Vulnerability/Plug-ins.Database........................................................242
Nessus.Policies.......................................................................................................243
Nessus.Credentials.................................................................................................243
OpenVAS.........................................................................................................................245
Plug-in.Update......................................................................................................246
Netcat.............................................................................................................................248
Port.Scanning.with.Netcat....................................................................................248
Nikto...............................................................................................................................250
Summary.........................................................................................................................251
10 Metasploit..................................................................................................................253
Introduction....................................................................................................................253
Payload.into.EXE............................................................................................................271
WebDAV.DLL.HiJacker.................................................................................................283
Summary........................................................................................................................287
11 Other.Attack.Tools....................................................................................................289
Overview........................................................................................................................289
Sysinternals.....................................................................................................................289
Pslist...............................................................................................................................289
Tasklist/m.......................................................................................................................290
Netstat.–ano...................................................................................................................290
Process.Explorer...............................................................................................................291
Remote.Administration.Tools..........................................................................................291
Poison.Ivy.RAT..............................................................................................................292
Accepting.Poison.Ivy.Connections........................................................................292
Building.Poison.Ivy.Backdoors........................................................................................293
Preparing.Beaconing.Malware.........................................................................................293
Preparing.Install.of.Malware..........................................................................................294
Advanced.Poison.Ivy.Options.........................................................................................295
Generating.a.PE..............................................................................................................296
Commanding.and.Controlling.Victims.with.Poison.Ivy.................................................296